Try to load the list of tests that TF-PSA-Crypto wants us to ignore in three
ways, depending on the age of the tf-psa-crypto submodule:
* Modern: import `tf_psa_crypto_test_case_info` as an ordinary module,
expected to be found in `tf-psa-crypto/scripts/project_knowledge`.
* First location, quickly superseded: load
`tf-psa-crypto/tests/scripts/tf_psa_crypto_test_case_info.py`,
in a hackish way because we don't want to put that directory on the
load path.
* Oldest: there is no `tf_psa_crypto_test_case_info.py`. Use a hard-coded
list.
Once all the TF-PSA-Crypto branches we care about (e.g. pull requests
in progress) are updated with
`tf-psa-crypto/scripts/project_knowledge/tf_psa_crypto_test_case_info.py`,
we can drop the backward compatibilty hacks and simply
`import tf_psa_crypto_test_case_info` unconditionally and use
`tf_psa_crypto_test_case_info.INTERNAL_TEST_CASES` unconditionally.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This is required because if the user defined configuration file (not the
default one provided by mbedtls) includes files from the standard
C library then __STDC_WANT_LIB_EXT1__ won't be defined there which
cause weird build failures.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
When MBEDTLS_SSL_PROTO_TLS1_3 is enabled ensure that at least one of the
related key exchanges is also enabled.
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
ECDHE-RSA only requires RSA signature, not encryption. This commits fixes
guards in "mbedtls_check_config.h".
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
Fix a TLS 1.2 client regression that caused valid ServerKeyExchange signatures using rsa_pss_rsae_* to be rejected.
Allow rsa_pss_rsae_* in the TLS 1.2 client ServerKeyExchange parse path when the algorithm is supported and was offered by the client. Add OpenSSL and GnuTLS interoperability coverage for TLS 1.2 servers that force rsa_pss_rsae_sha256.
Fixes#10668.
Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
This way, when Mbed TLS's `analyze_outcomes.py` loads the python module from
TF-PSA-Crypto (because it needs to know the value of `INTERNAL_TEST_CASES`),
there's no risk that the subproject and the superproject will have different
requirements on auxiliary modules such as `mbedtls_framework.outcome_analysis`.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
If we can't read `INTERNAL_TEST_CASES` from
`tf-psa-crypto/tests/scripts/analyze_outcomes.py` because the script doesn't
exist, hard-code the legacy value of that information.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
If the `tf-psa-crypto` submodule has `tests/scripts/analyze_outcomes.py`,
require it to define a global variable `INTERNAL_TEST_CASES`. Those test
cases will be ignored in Mbed TLS's coverage analysis.
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
